@zhin.js/agent 1.1.23 → 1.1.26

package/lib/workroom/journal.js

@@ -1,2038 +0,0 @@
-import { createHash } from 'node:crypto';
-import { readFile, readdir } from 'node:fs/promises';
-import { basename, join } from 'node:path';
-import { assertAcceptanceContract, assertPersistedAcceptanceRecord } from './acceptance-policy.js';
-import { canonicalWorkroomJson, compareCanonicalWorkroomText, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue, } from './canonical-value.js';
-import { assertWorkflowPlanProposal } from './workflow-plan-builder.js';
-import { assertWorkflowPlanRevisionCandidate } from './plan-revision.js';
-import { parseWorkroomRemoteAssignmentIssuance } from './remote-assignment-issuance.js';
-import { parseWorkroomLocalAssignmentIssuance } from './local-assignment-issuance.js';
-import { isWorkroomRunCancelReasonCode, isWorkroomRunReplanReasonCode, } from './workroom-run-control.js';
-import { assertWorkroomSchedulerPolicySnapshot, parseWorkroomDispatchTaskDecision, parseWorkroomPreemptionPrepareDecision, parseWorkroomPriorityChangeProposal, } from './workroom-scheduler.js';
-import { DurableFileStore } from './durable-file-store.js';
-import { FileLegacyEmbeddedPayloadReadAdapter, LegacyEmbeddedPayloadDetectedError, assertActiveStoreHasNoLegacyEmbeddedPayload, } from './legacy-embedded-payload-migration.js';
-export class WorkroomJournalPayloadAuthorityUnavailableError extends Error {
-    constructor() {
-        super('Governed Workroom Journal payload authority is unavailable');
-        this.name = 'WorkroomJournalPayloadAuthorityUnavailableError';
-    }
-}
-export class WorkroomSequenceConflictError extends Error {
-    runId;
-    expectedSequence;
-    actualSequence;
-    constructor(runId, expectedSequence, actualSequence) {
-        super(`Workroom ${runId} sequence conflict: expected ${expectedSequence}, actual ${actualSequence}`);
-        this.runId = runId;
-        this.expectedSequence = expectedSequence;
-        this.actualSequence = actualSequence;
-        this.name = 'WorkroomSequenceConflictError';
-    }
-}
-export class MemoryWorkroomJournal {
-    #runs = new Map();
-    #payloads;
-    constructor(payloads = new MemoryWorkroomJournalPayloadPort()) {
-        this.#payloads = payloads;
-    }
-    async listRunIds() {
-        return Object.freeze([...this.#runs.keys()].sort());
-    }
-    async scanStoredHeaders() {
-        return Object.freeze([...this.#runs.entries()]
-            .sort(([left], [right]) => compareCanonicalWorkroomText(left, right))
-            .map(([runId, events]) => storedRunHeaders(runId, events)));
-    }
-    async readStoredHeaders(runId) {
-        const events = this.#runs.get(runId) ?? [];
-        return events.length === 0 ? null : storedRunHeaders(runId, events);
-    }
-    async verifyGovernedPayloadPublication(intent) {
-        const events = this.#runs.get(intent.publicationScope ?? '') ?? [];
-        return verifyJournalPayloadPublication(intent, events);
-    }
-    async read(runId) {
-        const events = this.#runs.get(runId) ?? [];
-        return events.length === 0
-            ? Object.freeze([])
-            : await materializeStoredEvents(events, this.#payloads);
-    }
-    async append(runId, expectedSequence, drafts) {
-        const current = this.#runs.get(runId) ?? [];
-        const actualSequence = current.at(-1)?.sequence ?? -1;
-        if (actualSequence !== expectedSequence) {
-            throw new WorkroomSequenceConflictError(runId, expectedSequence, actualSequence);
-        }
-        if (drafts.length === 0)
-            return [];
-        const appended = materializeEvents(runId, expectedSequence, drafts);
-        const projectId = projectIdForAppend(current, appended);
-        const protectedEvents = await protectEvents(appended, projectId, this.#payloads);
-        const winner = this.#runs.get(runId) ?? [];
-        const winnerSequence = winner.at(-1)?.sequence ?? -1;
-        if (winnerSequence !== expectedSequence) {
-            throw new WorkroomSequenceConflictError(runId, expectedSequence, winnerSequence);
-        }
-        this.#runs.set(runId, Object.freeze([...current, ...protectedEvents]));
-        return appended;
-    }
-}
-/** In-memory authority used by the non-production Memory journal. */
-export class MemoryWorkroomJournalPayloadPort {
-    #values = new Map();
-    async write(input) {
-        if (digestCanonicalWorkroomValue(input.value) !== input.contentHash) {
-            throw new Error('Memory Workroom Journal payload content hash drift');
-        }
-        const objectId = createWorkroomJournalPayloadObjectId(input);
-        const vaultObjectId = `memory:${digestCanonicalWorkroomValue({ objectId, contentHash: input.contentHash })}`;
-        const existing = this.#values.get(vaultObjectId);
-        if (existing !== undefined
-            && digestCanonicalWorkroomValue(existing) !== input.contentHash) {
-            throw new Error('Memory Workroom Journal payload identity conflict');
-        }
-        this.#values.set(vaultObjectId, structuredClone(input.value));
-        return Object.freeze({
-            descriptor: Object.freeze({
-                vaultObjectId,
-                objectId,
-                payloadHash: input.contentHash,
-                descriptorDigest: digestCanonicalWorkroomValue({
-                    objectId,
-                    payloadHash: input.contentHash,
-                    projectId: input.projectId,
-                }),
-                locationManifestDigest: digestCanonicalWorkroomValue({ location: vaultObjectId }),
-                bytes: Buffer.byteLength(canonicalWorkroomJson(input.value)),
-            }),
-            source: Object.freeze({
-                kind: 'command',
-                ref: input.source.ref,
-                digest: input.source.digest,
-                bindingDigest: input.source.bindingDigest,
-                verification: 'verified',
-            }),
-        });
-    }
-    async read(input) {
-        const value = this.#values.get(input.receipt.descriptor.vaultObjectId);
-        if (value === undefined)
-            throw new Error('Memory Workroom Journal payload is unavailable');
-        return structuredClone(value);
-    }
-}
-/**
- * Durable append-only journal. Every committed batch is an immutable segment;
- * publishing its first sequence with an exclusive hard-link is the filesystem
- * CAS. Separate generation instances and separate processes therefore cannot
- * overwrite one another after reading the same expectedSequence.
- */
-export class FileWorkroomJournal {
-    #directory;
-    #store;
-    #payloads;
-    constructor(directory, payloads) {
-        this.#directory = directory;
-        this.#store = new DurableFileStore(directory);
-        this.#payloads = payloads;
-    }
-    async listRunIds() {
-        let names;
-        try {
-            names = await readdir(this.#directory);
-        }
-        catch (error) {
-            if (isMissingFile(error))
-                return Object.freeze([]);
-            throw error;
-        }
-        if (names.some(name => name.endsWith('.json') && !isSegmentName(name))) {
-            throw new Error('Invalid Workroom journal segment name');
-        }
-        const ids = new Set();
-        for (const name of names) {
-            if (!isSegmentName(name))
-                continue;
-            const events = await this.#readStoredFile(join(this.#directory, name), segmentFirstSequence(name));
-            const runId = events[0]?.runId;
-            if (runId)
-                ids.add(runId);
-        }
-        if (ids.size > 0)
-            await this.#store.syncLeaf();
-        return Object.freeze([...ids].sort());
-    }
-    async scanStoredHeaders() {
-        const groups = new Map();
-        let names;
-        try {
-            names = (await readdir(this.#directory)).filter(name => name.endsWith('.json')).sort();
-        }
-        catch (error) {
-            if (isMissingFile(error))
-                return Object.freeze([]);
-            throw error;
-        }
-        if (names.some(name => !isSegmentName(name))) {
-            throw new Error('Invalid Workroom journal segment name');
-        }
-        for (const name of names) {
-            const events = await this.#readStoredFile(join(this.#directory, name), segmentFirstSequence(name));
-            const runId = events[0]?.runId;
-            if (!runId)
-                throw new Error('Workroom journal segment has no Run header');
-            groups.set(runId, [...(groups.get(runId) ?? []), ...events]);
-        }
-        if (groups.size > 0)
-            await this.#store.syncLeaf();
-        return Object.freeze([...groups.entries()]
-            .sort(([left], [right]) => compareCanonicalWorkroomText(left, right))
-            .map(([runId, events]) => storedRunHeaders(runId, events)));
-    }
-    async readStoredHeaders(runId) {
-        const events = await this.#readStoredWithoutPayloads(runId);
-        return events.length === 0 ? null : storedRunHeaders(runId, events);
-    }
-    async verifyGovernedPayloadPublication(intent) {
-        if (!intent.publicationScope)
-            return deepFreeze({ status: 'missing' });
-        return verifyJournalPayloadPublication(intent, await this.#readStoredWithoutPayloads(intent.publicationScope));
-    }
-    async read(runId) {
-        const digest = this.#digest(runId);
-        let names;
-        try {
-            const entries = await readdir(this.#directory);
-            names = entries
-                .filter(name => name.startsWith(`${digest}.`) && name.endsWith('.json'));
-            if (names.some(name => !isSegmentName(name))) {
-                throw new Error('Invalid Workroom journal segment name');
-            }
-            names.sort();
-        }
-        catch (error) {
-            if (isMissingFile(error))
-                return [];
-            throw error;
-        }
-        const segments = await Promise.all(names.map(name => this.#readStoredFile(join(this.#directory, name), segmentFirstSequence(name))));
-        const events = segments.flat();
-        if (events.some(event => event.runId !== runId)) {
-            throw new Error('Workroom journal digest collision');
-        }
-        const ordered = events.sort((left, right) => left.sequence - right.sequence);
-        if (ordered.some((event, index) => event.sequence !== index)) {
-            throw new Error('Workroom journal sequence is not contiguous');
-        }
-        if (ordered.length > 0) {
-            await this.#store.syncLeaf();
-            await reconcileJournalPayloads(runId, ordered, this.#requirePayloads());
-        }
-        if (ordered.length === 0)
-            return Object.freeze([]);
-        return await materializeStoredEvents(Object.freeze(ordered), this.#requirePayloads());
-    }
-    async append(runId, expectedSequence, drafts) {
-        const current = await this.#readStored(runId);
-        const actualSequence = current.at(-1)?.sequence ?? -1;
-        if (actualSequence !== expectedSequence) {
-            throw new WorkroomSequenceConflictError(runId, expectedSequence, actualSequence);
-        }
-        if (drafts.length === 0)
-            return [];
-        const result = materializeEvents(runId, expectedSequence, drafts);
-        const projectId = projectIdForAppend(current, result);
-        await this.#store.ensureDurableLeaf('Workroom Journal');
-        await this.#assertNoLegacyEmbeddedPayload();
-        const protectedEvents = await protectEvents(result, projectId, this.#requirePayloads());
-        const segment = this.#segmentPath(runId, expectedSequence + 1);
-        const payload = Object.freeze({
-            version: 3,
-            runId,
-            expectedSequence,
-            events: protectedEvents,
-        });
-        const stored = Object.freeze({
-            ...payload,
-            payloadDigest: digestCanonicalWorkroomValue(payload),
-        });
-        const receipts = collectGovernedPayloadReceipts(protectedEvents);
-        await this.#requirePayloads().prepare?.({ projectId, runId, receipts });
-        let headerPublished = false;
-        try {
-            const published = await this.#store.publishCreateOnly({
-                target: segment,
-                content: canonicalWorkroomJson(stored),
-                createdValue: result,
-                onConflict: async () => {
-                    const winner = await this.#readStored(runId);
-                    throw new WorkroomSequenceConflictError(runId, expectedSequence, winner.at(-1)?.sequence ?? -1);
-                },
-            });
-            headerPublished = true;
-            await this.#requirePayloads().publish?.({
-                projectId,
-                runId,
-                receipts,
-                publicationDigest: journalPublicationDigest(runId, [...current, ...protectedEvents]),
-            });
-            return published.value;
-        }
-        catch (error) {
-            if (!headerPublished) {
-                await this.#requirePayloads().abandon?.({ projectId, runId, receipts, reason: 'cas_lost' });
-            }
-            throw error;
-        }
-    }
-    async #readStored(runId) {
-        const events = await this.#readStoredWithoutPayloads(runId);
-        if (events.length > 0)
-            await reconcileJournalPayloads(runId, events, this.#requirePayloads());
-        return events;
-    }
-    async #assertNoLegacyEmbeddedPayload() {
-        const names = await readdir(this.#directory);
-        const unexpected = names.find(name => !isSegmentName(name) && !isSegmentTemporaryName(name));
-        if (unexpected)
-            throw new Error('Invalid Workroom journal segment name');
-        const segments = names.filter(isSegmentName).sort();
-        if (segments.length === 0)
-            return;
-        await assertActiveStoreHasNoLegacyEmbeddedPayload(new FileLegacyEmbeddedPayloadReadAdapter(segments.map(name => ({ sourceKind: 'journal', path: join(this.#directory, name) }))));
-    }
-    async #readStoredWithoutPayloads(runId) {
-        const digest = this.#digest(runId);
-        let names;
-        try {
-            names = (await readdir(this.#directory))
-                .filter(name => name.startsWith(`${digest}.`) && name.endsWith('.json'))
-                .sort();
-        }
-        catch (error) {
-            if (isMissingFile(error))
-                return [];
-            throw error;
-        }
-        const events = (await Promise.all(names.map(name => this.#readStoredFile(join(this.#directory, name), segmentFirstSequence(name))))).flat().sort((left, right) => left.sequence - right.sequence);
-        if (events.some((event, index) => event.runId !== runId || event.sequence !== index)) {
-            throw new Error('Workroom journal sequence or Run binding is invalid');
-        }
-        if (events.length > 0)
-            await this.#store.syncLeaf();
-        return Object.freeze(events);
-    }
-    async #readStoredFile(path, expectedFirstSequence) {
-        try {
-            const parsed = JSON.parse(await readFile(path, 'utf8'));
-            if (Array.isArray(parsed)) {
-                throw legacyJournalPayloadError();
-            }
-            if (isRecord(parsed) && (parsed.version === 1 || parsed.version === 2)) {
-                throw legacyJournalPayloadError();
-            }
-            if (!isRecord(parsed) || parsed.version !== 3 || !isNonEmptyString(parsed.runId)
-                || !Number.isSafeInteger(parsed.expectedSequence)
-                || !Array.isArray(parsed.events) || typeof parsed.payloadDigest !== 'string') {
-                throw new Error('Invalid Workroom journal segment envelope');
-            }
-            if (parsed.expectedSequence !== expectedFirstSequence - 1) {
-                throw new Error('Workroom journal segment first sequence does not match its filename');
-            }
-            const events = parseStoredEvents(parsed.events);
-            const payload = Object.freeze({
-                version: 3,
-                runId: parsed.runId,
-                expectedSequence: parsed.expectedSequence,
-                events,
-            });
-            const stored = Object.freeze({
-                ...payload,
-                payloadDigest: parsed.payloadDigest,
-            });
-            if (parsed.payloadDigest !== digestCanonicalWorkroomValue(payload)
-                || canonicalWorkroomJson(parsed) !== canonicalWorkroomJson(stored)) {
-                throw new Error('Workroom journal segment payload digest mismatch');
-            }
-            if (events.some(event => event.runId !== parsed.runId)) {
-                throw new Error('Workroom journal segment Run binding drift');
-            }
-            if (basename(path) !== `${this.#digest(parsed.runId)}.${String(expectedFirstSequence).padStart(16, '0')}.json`) {
-                throw new Error('Workroom journal segment Run digest does not match its filename');
-            }
-            if (events.length === 0 || events[0].sequence !== expectedFirstSequence) {
-                throw new Error('Workroom journal segment first sequence does not match its filename');
-            }
-            if (events.some((event, index) => event.sequence !== expectedFirstSequence + index)) {
-                throw new Error('Workroom journal segment sequence is not contiguous');
-            }
-            return events;
-        }
-        catch (error) {
-            if (isMissingFile(error))
-                return [];
-            throw error;
-        }
-    }
-    #digest(runId) {
-        return createHash('sha256').update(runId).digest('hex');
-    }
-    #segmentPath(runId, firstSequence) {
-        return join(this.#directory, `${this.#digest(runId)}.${String(firstSequence).padStart(16, '0')}.json`);
-    }
-    #requirePayloads() {
-        if (!this.#payloads)
-            throw new WorkroomJournalPayloadAuthorityUnavailableError();
-        return this.#payloads;
-    }
-}
-/** Candidate-owned latch: no caller can observe a placeholder journal. */
-export class ActivatableWorkroomJournal {
-    #delegate = null;
-    get active() {
-        return this.#delegate !== null;
-    }
-    activate(delegate) {
-        if (this.#delegate)
-            throw new Error('Workroom journal is already active');
-        this.#delegate = delegate;
-    }
-    listRunIds() {
-        return this.#require().listRunIds();
-    }
-    scanStoredHeaders() {
-        return this.#require().scanStoredHeaders();
-    }
-    readStoredHeaders(runId) {
-        return this.#require().readStoredHeaders(runId);
-    }
-    verifyGovernedPayloadPublication(intent) {
-        const delegate = this.#require();
-        return delegate.verifyGovernedPayloadPublication
-            ? delegate.verifyGovernedPayloadPublication(intent)
-            : Promise.resolve(deepFreeze({ status: 'unknown' }));
-    }
-    read(runId) {
-        return this.#require().read(runId);
-    }
-    append(runId, expectedSequence, events) {
-        return this.#require().append(runId, expectedSequence, events);
-    }
-    #require() {
-        if (!this.#delegate)
-            throw new Error('Workroom journal is not active');
-        return this.#delegate;
-    }
-}
-export class DatabaseWorkroomJournal {
-    #database;
-    #eventModel;
-    #payloads;
-    constructor(database, eventModel, payloads) {
-        this.#database = database;
-        this.#eventModel = eventModel;
-        this.#payloads = payloads;
-    }
-    async listRunIds() {
-        return Object.freeze((await this.scanStoredHeaders()).map(run => run.runId));
-    }
-    async scanStoredHeaders() {
-        const rows = await this.#eventModel.select().where({});
-        return Object.freeze([...parseStoredRowGroups(rows).entries()]
-            .map(([runId, events]) => storedRunHeaders(runId, events)));
-    }
-    async readStoredHeaders(runId) {
-        const rows = await this.#eventModel.select().where({ run_id: runId });
-        const events = parseStoredRows(runId, rows);
-        return events.length === 0 ? null : storedRunHeaders(runId, events);
-    }
-    async verifyGovernedPayloadPublication(intent) {
-        if (!intent.publicationScope)
-            return deepFreeze({ status: 'missing' });
-        const rows = await this.#eventModel.select().where({ run_id: intent.publicationScope });
-        return verifyJournalPayloadPublication(intent, parseStoredRows(intent.publicationScope, rows));
-    }
-    async read(runId) {
-        const rows = await this.#eventModel.select().where({ run_id: runId });
-        const events = parseStoredRows(runId, rows);
-        if (events.length === 0)
-            return Object.freeze([]);
-        await reconcileJournalPayloads(runId, events, this.#requirePayloads());
-        return await materializeStoredEvents(events, this.#requirePayloads());
-    }
-    async append(runId, expectedSequence, drafts) {
-        let publication;
-        let headerPublished = false;
-        try {
-            const allRows = await this.#eventModel.select().where({});
-            await assertActiveStoreHasNoLegacyEmbeddedPayload({
-                read: async () => legacyDatabaseJournalRecords(allRows),
-            });
-            const current = parseStoredRowGroups(allRows).get(runId) ?? Object.freeze([]);
-            if (current.length > 0) {
-                await reconcileJournalPayloads(runId, current, this.#requirePayloads());
-            }
-            const actualSequence = current.at(-1)?.sequence ?? -1;
-            if (actualSequence !== expectedSequence) {
-                throw new WorkroomSequenceConflictError(runId, expectedSequence, actualSequence);
-            }
-            if (drafts.length === 0)
-                return [];
-            const appended = materializeEvents(runId, expectedSequence, drafts);
-            const projectId = projectIdForAppend(current, appended);
-            const protectedEvents = await protectEvents(appended, projectId, this.#requirePayloads());
-            publication = { projectId, protectedEvents, current };
-            await this.#requirePayloads().prepare?.({
-                projectId,
-                runId,
-                receipts: collectGovernedPayloadReceipts(protectedEvents),
-            });
-            await this.#database.transaction(async (transaction) => {
-                const transactionRows = await transaction.select('workroom_events').where({});
-                await assertActiveStoreHasNoLegacyEmbeddedPayload({
-                    read: async () => legacyDatabaseJournalRecords(transactionRows),
-                });
-                const transactionCurrent = parseStoredRowGroups(transactionRows).get(runId)
-                    ?? Object.freeze([]);
-                const transactionSequence = transactionCurrent.at(-1)?.sequence ?? -1;
-                if (transactionSequence !== expectedSequence) {
-                    throw new WorkroomSequenceConflictError(runId, expectedSequence, transactionSequence);
-                }
-                await transaction.insertMany('workroom_events', protectedEvents.map(toRow));
-            }, { isolationLevel: 'SERIALIZABLE' });
-            headerPublished = true;
-            await this.#requirePayloads().publish?.({
-                projectId: publication.projectId,
-                runId,
-                receipts: collectGovernedPayloadReceipts(publication.protectedEvents),
-                publicationDigest: journalPublicationDigest(runId, [...publication.current, ...publication.protectedEvents]),
-            });
-            return appended;
-        }
-        catch (error) {
-            if (publication && !headerPublished) {
-                await this.#requirePayloads().abandon?.({
-                    projectId: publication.projectId,
-                    runId,
-                    receipts: collectGovernedPayloadReceipts(publication.protectedEvents),
-                    reason: error instanceof WorkroomSequenceConflictError ? 'cas_lost' : 'write_failed',
-                });
-            }
-            if (error instanceof WorkroomSequenceConflictError || headerPublished)
-                throw error;
-            // A serializable/unique-key loser is dialect-specific. Re-read the
-            // authoritative sequence and normalize only a proven concurrent winner;
-            // unrelated database failures retain their original error.
-            const actualSequence = (await this.read(runId)).at(-1)?.sequence ?? -1;
-            if (actualSequence !== expectedSequence) {
-                throw new WorkroomSequenceConflictError(runId, expectedSequence, actualSequence);
-            }
-            throw error;
-        }
-    }
-    #requirePayloads() {
-        if (!this.#payloads)
-            throw new WorkroomJournalPayloadAuthorityUnavailableError();
-        return this.#payloads;
-    }
-}
-function legacyDatabaseJournalRecords(rows) {
-    return Object.freeze(rows.map(row => {
-        let envelope;
-        try {
-            envelope = JSON.parse(String(row.payload_json));
-        }
-        catch {
-            throw new Error('Legacy Workroom Journal database payload is corrupt or unknown');
-        }
-        return Object.freeze({
-            storage: 'database',
-            sourceKind: 'journal',
-            recordRef: `workroom-events:${digestCanonicalWorkroomValue({
-                runId: String(row.run_id),
-                sequence: row.sequence,
-            })}`,
-            value: Object.freeze({ version: row.version, envelope }),
-        });
-    }));
-}
-function materializeEvents(runId, expectedSequence, drafts) {
-    if (!isNonEmptyString(runId) || !Number.isSafeInteger(expectedSequence) || expectedSequence < -1) {
-        throw new Error('Invalid Workroom append position');
-    }
-    return Object.freeze(drafts.map((draft, index) => {
-        if (!isNonEmptyString(draft.eventId) || !isFiniteNumber(draft.occurredAt)
-            || !isWorkroomEventType(draft.type) || !isRecord(draft.payload)) {
-            throw new Error('Invalid Workroom event draft');
-        }
-        validatePayload(draft.type, draft.payload, expectedSequence + index + 1);
-        return Object.freeze({
-            ...draft,
-            version: 1,
-            runId,
-            sequence: expectedSequence + index + 1,
-            payload: Object.freeze({ ...draft.payload }),
-        });
-    }));
-}
-function parseStoredEvents(values) {
-    const events = values.map((value) => {
-        if (!value || typeof value !== 'object' || Array.isArray(value)) {
-            throw new Error('Invalid Workroom journal event');
-        }
-        const raw = value;
-        if (raw.version === 1 || raw.version === 2)
-            throw legacyJournalPayloadError();
-        assertExactRecordKeys(raw, [
-            'version', 'eventId', 'runId', 'sequence', 'occurredAt', 'type', 'control', 'payload',
-        ], 'Stored Workroom event');
-        const event = value;
-        if (event.version !== 3 || !isNonEmptyString(event.eventId) || !isNonEmptyString(event.runId)
-            || !isSequence(event.sequence) || !isFiniteNumber(event.occurredAt)
-            || !isWorkroomEventType(event.type) || !isRecord(event.control) || !isRecord(event.payload)) {
-            throw new Error('Invalid Workroom journal event');
-        }
-        validateStoredEventControl(event.type, event.control);
-        validateProtectedPayload(event.type, event.payload);
-        const sequence = Number(event.sequence);
-        return Object.freeze({
-            ...event,
-            version: 3,
-            eventId: event.eventId,
-            runId: event.runId,
-            sequence,
-            occurredAt: event.occurredAt,
-            type: event.type,
-            control: deepFreeze({ ...event.control }),
-            payload: Object.freeze({ ...event.payload }),
-        });
-    });
-    return Object.freeze(events.sort((left, right) => left.sequence - right.sequence));
-}
-function isMissingFile(error) {
-    return !!error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT';
-}
-function isSegmentName(name) {
-    return /^[a-f0-9]{64}\.[0-9]{16}\.json$/u.test(name);
-}
-function isSegmentTemporaryName(name) {
-    return /^[a-f0-9]{64}\.[0-9]{16}\.json\.[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}\.tmp$/u
-        .test(name);
-}
-function segmentFirstSequence(name) {
-    if (!isSegmentName(name))
-        throw new Error('Invalid Workroom journal segment name');
-    const value = Number(name.slice(65, 81));
-    if (!Number.isSafeInteger(value) || value < 0) {
-        throw new Error('Invalid Workroom journal segment first sequence');
-    }
-    return value;
-}
-function toRow(event) {
-    const storedEventDigest = digestStoredWorkroomEvent(event);
-    const row = {
-        id: `${event.runId}:${event.sequence}`,
-        run_id: event.runId,
-        sequence: event.sequence,
-        version: event.version,
-        type: event.type,
-        payload_json: canonicalWorkroomJson({
-            eventId: event.eventId,
-            control: event.control,
-            payload: event.payload,
-        }),
-        occurred_at: event.occurredAt,
-        stored_event_digest: storedEventDigest,
-    };
-    return { ...row, row_binding_digest: digestWorkroomEventRowBinding(row) };
-}
-function parseStoredRows(runId, rows) {
-    const events = rows.map(row => {
-        if (row.version === 1 || row.version === 2)
-            throw legacyJournalPayloadError();
-        if (!isDigest(row.stored_event_digest) || !isDigest(row.row_binding_digest)) {
-            throw legacyJournalPayloadError();
-        }
-        if (row.version !== 3)
-            throw new Error(`Unsupported Workroom event version: ${String(row.version)}`);
-        let envelope;
-        try {
-            envelope = JSON.parse(String(row.payload_json));
-        }
-        catch {
-            throw new Error('Invalid Workroom event payload JSON');
-        }
-        if (!envelope || !isNonEmptyString(envelope.eventId) || !isRecord(envelope.control)
-            || !isRecord(envelope.payload)
-            || !isSequence(row.sequence) || !isFiniteNumber(row.occurred_at)
-            || !isWorkroomEventType(row.type)) {
-            throw new Error('Invalid Workroom event payload envelope');
-        }
-        assertExactRecordKeys(envelope, ['eventId', 'control', 'payload'], 'Workroom event payload envelope');
-        const expectedId = `${runId}:${Number(row.sequence)}`;
-        if (row.id !== expectedId)
-            throw new Error('Workroom event row id binding is invalid');
-        if (String(row.payload_json) !== canonicalWorkroomJson(envelope)) {
-            throw new Error('Workroom event payload JSON is not canonical');
-        }
-        validateStoredEventControl(row.type, envelope.control);
-        validateProtectedPayload(row.type, envelope.payload);
-        const event = Object.freeze({
-            version: 3,
-            eventId: envelope.eventId,
-            runId,
-            sequence: row.sequence,
-            occurredAt: row.occurred_at,
-            type: row.type,
-            control: deepFreeze({ ...envelope.control }),
-            payload: Object.freeze({ ...envelope.payload }),
-        });
-        if (row.stored_event_digest !== digestStoredWorkroomEvent(event)) {
-            throw new Error('Workroom stored event digest mismatch');
-        }
-        if (row.row_binding_digest !== digestWorkroomEventRowBinding(row)) {
-            throw new Error('Workroom event row binding digest mismatch');
-        }
-        return event;
-    }).sort((left, right) => left.sequence - right.sequence);
-    const stored = Object.freeze(events);
-    if (stored.length > 0)
-        assertStoredEventReceiptBindings(stored);
-    return stored;
-}
-function parseStoredRowGroups(rows) {
-    const rowGroups = new Map();
-    for (const row of rows) {
-        const runId = String(row.run_id ?? '');
-        if (!isNonEmptyString(runId))
-            throw new Error('Invalid Workroom event Run id');
-        rowGroups.set(runId, [...(rowGroups.get(runId) ?? []), row]);
-    }
-    return new Map([...rowGroups.entries()]
-        .sort(([left], [right]) => compareCanonicalWorkroomText(left, right))
-        .map(([runId, runRows]) => [runId, parseStoredRows(runId, runRows)]));
-}
-export function digestStoredWorkroomEvent(event) {
-    return digestCanonicalWorkroomValue({
-        version: event.version,
-        eventId: event.eventId,
-        runId: event.runId,
-        sequence: event.sequence,
-        occurredAt: event.occurredAt,
-        type: event.type,
-        control: event.control,
-        payload: event.payload,
-    });
-}
-export function digestWorkroomEventRowBinding(row) {
-    return digestCanonicalWorkroomValue({
-        version: 1,
-        id: row.id,
-        runId: row.run_id,
-        sequence: row.sequence,
-        storedVersion: row.version,
-        type: row.type,
-        payloadJson: row.payload_json,
-        occurredAt: row.occurred_at,
-        storedEventDigest: row.stored_event_digest,
-    });
-}
-function storedRunHeaders(runId, values) {
-    if (!isNonEmptyString(runId) || values.length === 0
-        || values.some((event, index) => event.runId !== runId || event.sequence !== index)) {
-        throw new Error('Stored Workroom Journal header sequence or Run binding is invalid');
-    }
-    assertStoredEventReceiptBindings(values);
-    const events = values.map((event) => {
-        const protectedPayloadDigest = digestCanonicalWorkroomValue(event.payload);
-        const body = deepFreeze({
-            version: 1,
-            eventRef: `workroom-event:${digestCanonicalWorkroomValue({
-                runId, eventId: event.eventId, sequence: event.sequence,
-            })}`,
-            runId,
-            sequence: event.sequence,
-            occurredAt: event.occurredAt,
-            type: event.type,
-            control: event.control,
-            protectedPayloadDigest,
-            protectedReceipts: storedProtectedReceiptHeaders(event.payload),
-        });
-        return deepFreeze({ ...body, digest: digestCanonicalWorkroomValue(body) });
-    });
-    const body = deepFreeze({ version: 1, runId, events });
-    return deepFreeze({ ...body, digest: digestCanonicalWorkroomValue(body) });
-}
-function deriveStoredEventControl(event) {
-    const payload = event.payload;
-    const taskKey = () => opaqueStoredRef('task', event.runId, storedHeaderText(payload, 'taskKey'));
-    const assignmentId = () => opaqueStoredRef('assignment', event.runId, storedHeaderText(payload, 'assignmentId'));
-    switch (event.type) {
-        case 'run.created': return deepFreeze({ projectId: storedHeaderText(payload, 'projectId') });
-        case 'task.planned': return deepFreeze({
-            taskKey: taskKey(),
-            required: payload.required === true,
-            maxAttempts: storedHeaderPositiveInteger(payload, 'maxAttempts'),
-        });
-        case 'task.blocked': return deepFreeze({
-            taskKey: taskKey(),
-            blockerId: opaqueStoredRef('blocker', event.runId, storedHeaderText(payload, 'blockerId')),
-            blockerKind: storedHeaderBlockerKind(payload.kind),
-            blockerDeadline: storedHeaderNonNegativeInteger(payload, 'deadline'),
-            blockerAllowedActions: Object.freeze(['resolve', 'replan', 'cancel']),
-        });
-        case 'task.blocker_resolved': return deepFreeze({
-            taskKey: taskKey(),
-            blockerId: opaqueStoredRef('blocker', event.runId, storedHeaderText(payload, 'blockerId')),
-        });
-        case 'assignment.claimed': return deepFreeze({
-            taskKey: taskKey(),
-            assignmentId: assignmentId(),
-            role: storedHeaderRole(payload.role),
-            attempt: storedHeaderPositiveInteger(payload, 'attempt'),
-            assignmentRevision: storedHeaderPositiveInteger(payload, 'assignmentRevision'),
-            fence: storedHeaderPositiveInteger(payload, 'fence'),
-        });
-        case 'assignment.started':
-        case 'assignment.progress':
-        case 'assignment.heartbeat':
-        case 'assignment.checkpointed':
-        case 'assignment.checkpoint_requested':
-        case 'assignment.preempted':
-        case 'assignment.execution_completed':
-        case 'assignment.cancel_requested':
-        case 'assignment.lease_expired': return deepFreeze({ assignmentId: assignmentId() });
-        case 'assignment.cancelled': return deepFreeze({
-            assignmentId: assignmentId(), outcome: storedHeaderOutcome(payload.outcome),
-        });
-        case 'task.accepted':
-        case 'task.acceptance_pinned':
-        case 'task.acceptance_blocked':
-        case 'task.cancel_requested':
-        case 'task.cancelled':
-        case 'task.failed':
-        case 'task.rework_requested': return deepFreeze({ taskKey: taskKey() });
-        case 'task.revised': return deepFreeze({
-            taskKey: taskKey(), maxAttempts: storedHeaderPositiveInteger(payload, 'maxAttempts'),
-        });
-        case 'task.plan_revised': return deepFreeze({
-            taskKey: taskKey(), required: payload.required === true,
-            maxAttempts: storedHeaderPositiveInteger(payload, 'maxAttempts'),
-            newTaskRevision: storedHeaderPositiveInteger(payload, 'newTaskRevision'),
-        });
-        case 'reviewer.assigned': {
-            const assignment = storedHeaderRecord(payload, 'assignment');
-            return deepFreeze({
-                taskKey: taskKey(),
-                waitId: opaqueStoredRef('reviewer', event.runId, storedHeaderText(assignment, 'id')),
-                waitStatus: storedHeaderText(assignment, 'status'),
-            });
-        }
-        case 'reviewer.claimed':
-        case 'reviewer.verdict_recorded':
-        case 'reviewer.expired': return deepFreeze({
-            taskKey: taskKey(),
-            waitId: opaqueStoredRef('reviewer', event.runId, storedHeaderText(payload, 'assignmentId')),
-            ...(event.type === 'reviewer.verdict_recorded'
-                ? { verdictOutcome: payload.outcome === 'passed' ? 'passed' : 'rework' }
-                : {}),
-        });
-        case 'sponsor_gate.opened': {
-            const gate = storedHeaderRecord(payload, 'gate');
-            return deepFreeze({
-                taskKey: taskKey(),
-                waitId: opaqueStoredRef('sponsor-gate', event.runId, storedHeaderText(gate, 'id')),
-                waitStatus: storedHeaderText(gate, 'status'),
-            });
-        }
-        case 'sponsor_gate.decided': return deepFreeze({
-            taskKey: taskKey(),
-            waitId: opaqueStoredRef('sponsor-gate', event.runId, storedHeaderText(payload, 'gateId')),
-            decision: storedHeaderDecision(payload.decision),
-        });
-        case 'sponsor_gate.expired': return deepFreeze({
-            taskKey: taskKey(),
-            waitId: opaqueStoredRef('sponsor-gate', event.runId, storedHeaderText(payload, 'gateId')),
-        });
-        default: return Object.freeze({});
-    }
-}
-const WORKROOM_EVENT_CONTROL_KEYS = Object.freeze({
-    'run.created': ['projectId'],
-    'task.planned': ['taskKey', 'required', 'maxAttempts'],
-    'task.blocked': [
-        'taskKey', 'blockerId', 'blockerKind', 'blockerDeadline', 'blockerAllowedActions',
-    ],
-    'task.blocker_resolved': ['taskKey', 'blockerId'],
-    'assignment.claimed': [
-        'taskKey', 'assignmentId', 'role', 'attempt', 'assignmentRevision', 'fence',
-    ],
-    'assignment.started': ['assignmentId'],
-    'assignment.progress': ['assignmentId'],
-    'assignment.heartbeat': ['assignmentId'],
-    'assignment.checkpointed': ['assignmentId'],
-    'assignment.checkpoint_requested': ['assignmentId'],
-    'assignment.preempted': ['assignmentId'],
-    'assignment.execution_completed': ['assignmentId'],
-    'assignment.cancel_requested': ['assignmentId'],
-    'assignment.cancelled': ['assignmentId', 'outcome'],
-    'assignment.lease_expired': ['assignmentId'],
-    'task.accepted': ['taskKey'],
-    'task.acceptance_pinned': ['taskKey'],
-    'task.acceptance_blocked': ['taskKey'],
-    'task.cancel_requested': ['taskKey'],
-    'task.cancelled': ['taskKey'],
-    'task.failed': ['taskKey'],
-    'task.rework_requested': ['taskKey'],
-    'task.revised': ['taskKey', 'maxAttempts'],
-    'task.plan_revised': ['taskKey', 'required', 'maxAttempts', 'newTaskRevision'],
-    'reviewer.assigned': ['taskKey', 'waitId', 'waitStatus'],
-    'reviewer.claimed': ['taskKey', 'waitId'],
-    'reviewer.verdict_recorded': ['taskKey', 'waitId', 'verdictOutcome'],
-    'reviewer.expired': ['taskKey', 'waitId'],
-    'sponsor_gate.opened': ['taskKey', 'waitId', 'waitStatus'],
-    'sponsor_gate.decided': ['taskKey', 'waitId', 'decision'],
-    'sponsor_gate.expired': ['taskKey', 'waitId'],
-    'plan.admitted': [],
-    'plan.revision_applied': [],
-    'plan_gate.decided': [],
-    'run.control_decided': [],
-    'run.replan_requested': [],
-    'run.cancel_requested': [],
-    'run.cancelled': [],
-    'scheduler.dispatch_requested': [],
-    'scheduler.priority_changed': [],
-    'scheduler.preemption_requested': [],
-    'scheduler.preemption_checkpoint_acknowledged': [],
-    'scheduler.preemption_timed_out': [],
-    'local_execution.requested': [],
-    'remote_dispatch.requested': [],
-    'clock.advanced': [],
-});
-function validateStoredEventControl(type, control) {
-    const keys = type === 'task.blocked' && Object.keys(control).length === 2
-        ? ['taskKey', 'blockerId']
-        : WORKROOM_EVENT_CONTROL_KEYS[type];
-    assertExactRecordKeys(control, keys, 'Stored Workroom control');
-    if (control.projectId !== undefined)
-        storedHeaderText(control, 'projectId');
-    for (const key of ['taskKey', 'assignmentId', 'blockerId', 'waitId']) {
-        if (control[key] !== undefined && (typeof control[key] !== 'string'
-            || !/^workroom-[a-z-]+:[a-f0-9]{64}$/u.test(control[key]))) {
-            throw new Error(`Stored Workroom control ${key} is invalid`);
-        }
-    }
-    for (const key of ['maxAttempts', 'attempt', 'assignmentRevision', 'fence', 'newTaskRevision']) {
-        if (control[key] !== undefined)
-            storedHeaderPositiveInteger(control, key);
-    }
-    if (control.required !== undefined && typeof control.required !== 'boolean') {
-        throw new Error('Stored Workroom control required is invalid');
-    }
-    if (control.blockerKind !== undefined)
-        storedHeaderBlockerKind(control.blockerKind);
-    if (control.blockerDeadline !== undefined) {
-        storedHeaderNonNegativeInteger(control, 'blockerDeadline');
-    }
-    if (control.blockerAllowedActions !== undefined) {
-        storedHeaderBlockerActions(control.blockerAllowedActions);
-    }
-    if (control.role !== undefined)
-        storedHeaderRole(control.role);
-    if (control.outcome !== undefined)
-        storedHeaderOutcome(control.outcome);
-    if (control.decision !== undefined)
-        storedHeaderDecision(control.decision);
-    if (control.verdictOutcome !== undefined
-        && control.verdictOutcome !== 'passed' && control.verdictOutcome !== 'rework') {
-        throw new Error('Stored Workroom control verdict outcome is invalid');
-    }
-    if (control.waitStatus !== undefined && ![
-        'open', 'claimed', 'passed', 'rework', 'expired', 'cancelled', 'satisfied', 'stale',
-    ].includes(String(control.waitStatus))) {
-        throw new Error('Stored Workroom control wait status is invalid');
-    }
-}
-function storedProtectedReceiptHeaders(value) {
-    const headers = [];
-    const visit = (candidate) => {
-        if (isGovernedJournalPayloadReference(candidate)) {
-            headers.push(deepFreeze({
-                fieldPath: candidate.fieldPath,
-                contentHash: candidate.contentHash,
-                descriptorDigest: candidate.receipt.descriptor.descriptorDigest,
-                sourceDigest: candidate.receipt.source.digest,
-                sourceBindingDigest: candidate.receipt.source.bindingDigest,
-            }));
-            return;
-        }
-        if (Array.isArray(candidate)) {
-            for (const item of candidate)
-                visit(item);
-            return;
-        }
-        if (isRecord(candidate))
-            for (const item of Object.values(candidate))
-                visit(item);
-    };
-    visit(value);
-    return deepFreeze(headers.sort((left, right) => compareCanonicalWorkroomText(left.fieldPath, right.fieldPath)));
-}
-function opaqueStoredRef(kind, runId, rawId) {
-    return `workroom-${kind}:${digestCanonicalWorkroomValue({ kind, runId, rawId }).slice('sha256:'.length)}`;
-}
-function storedHeaderText(payload, key) {
-    const value = payload[key];
-    if (!isNonEmptyString(value))
-        throw new Error(`Stored Workroom header ${key} is invalid`);
-    return value;
-}
-function storedHeaderPositiveInteger(payload, key) {
-    const value = payload[key];
-    if (!Number.isSafeInteger(value) || Number(value) < 1) {
-        throw new Error(`Stored Workroom header ${key} is invalid`);
-    }
-    return Number(value);
-}
-function storedHeaderNonNegativeInteger(payload, key) {
-    const value = payload[key];
-    if (!Number.isSafeInteger(value) || Number(value) < 0) {
-        throw new Error(`Stored Workroom header ${key} is invalid`);
-    }
-    return Number(value);
-}
-function storedHeaderBlockerKind(value) {
-    if (value !== 'dependency' && value !== 'approval' && value !== 'capability'
-        && value !== 'external' && value !== 'human_input') {
-        throw new Error('Stored Workroom header Blocker kind is invalid');
-    }
-    return value;
-}
-function storedHeaderBlockerActions(value) {
-    if (!Array.isArray(value)
-        || canonicalWorkroomJson(value) !== canonicalWorkroomJson(['resolve', 'replan', 'cancel'])) {
-        throw new Error('Stored Workroom header Blocker allowedActions are invalid');
-    }
-    return Object.freeze([...value]);
-}
-function storedHeaderRecord(payload, key) {
-    const value = payload[key];
-    if (!isRecord(value))
-        throw new Error(`Stored Workroom header ${key} is invalid`);
-    return value;
-}
-function storedHeaderRole(value) {
-    if (value !== 'executor' && value !== 'reviewer' && value !== 'integration') {
-        throw new Error('Stored Workroom header Assignment role is invalid');
-    }
-    return value;
-}
-function storedHeaderOutcome(value) {
-    if (value !== 'interrupted' && value !== 'committed' && value !== 'outcome_unknown') {
-        throw new Error('Stored Workroom header Assignment outcome is invalid');
-    }
-    return value;
-}
-function storedHeaderDecision(value) {
-    if (value !== 'approve' && value !== 'reject' && value !== 'request_changes' && value !== 'cancel') {
-        throw new Error('Stored Workroom header Sponsor decision is invalid');
-    }
-    return value;
-}
-async function protectEvents(events, projectId, payloads) {
-    return Object.freeze(await Promise.all(events.map(async (event) => Object.freeze({
-        ...event,
-        version: 3,
-        control: deriveStoredEventControl(event),
-        payload: await protectValue(event.payload, '$.payload', event, projectId, payloads),
-    }))));
-}
-async function protectValue(value, fieldPath, event, projectId, payloads) {
-    if (Array.isArray(value)) {
-        return Object.freeze(await Promise.all(value.map((item, index) => protectValue(item, `${fieldPath}[${index}]`, event, projectId, payloads))));
-    }
-    if (!isRecord(value))
-        return value;
-    const entries = [];
-    for (const [key, child] of Object.entries(value)) {
-        const path = `${fieldPath}.${key}`;
-        if (!isContentFreeJournalValue(event.type, path, child) && containsGovernedValue(child)) {
-            const contentHash = digestCanonicalWorkroomValue(child);
-            const source = journalPayloadSource(event, path, contentHash);
-            const receipt = await payloads.write({
-                projectId,
-                runId: event.runId,
-                eventId: event.eventId,
-                eventType: event.type,
-                occurredAt: event.occurredAt,
-                fieldPath: path,
-                value: structuredClone(child),
-                contentHash,
-                source,
-            });
-            assertJournalPayloadReceipt(receipt, createWorkroomJournalPayloadObjectId({
-                projectId,
-                runId: event.runId,
-                eventId: event.eventId,
-                eventType: event.type,
-                occurredAt: event.occurredAt,
-                fieldPath: path,
-                contentHash,
-            }), contentHash, source);
-            entries.push([key, Object.freeze({
-                    version: 1,
-                    kind: 'governed_workroom_journal_payload',
-                    fieldPath: path,
-                    contentHash,
-                    receipt,
-                })]);
-            continue;
-        }
-        entries.push([key, await protectValue(child, path, event, projectId, payloads)]);
-    }
-    return Object.freeze(Object.fromEntries(entries));
-}
-async function materializeStoredEvents(events, payloads) {
-    assertStoredEventReceiptBindings(events);
-    const projectId = storedProjectId(events);
-    const materialized = await Promise.all(events.map(async (event) => {
-        const payload = await materializeValue(event.payload, '$.payload', event, projectId, payloads);
-        if (!isRecord(payload))
-            throw new Error('Materialized Workroom Journal payload is invalid');
-        validatePayload(event.type, payload, event.sequence);
-        const derivedControl = deriveStoredEventControl({ ...event, version: 1, payload });
-        const comparableControl = event.type === 'task.blocked'
-            && Object.keys(event.control).length === 2
-            ? Object.freeze({ taskKey: derivedControl.taskKey, blockerId: derivedControl.blockerId })
-            : derivedControl;
-        if (canonicalWorkroomJson(event.control) !== canonicalWorkroomJson(comparableControl)) {
-            throw new Error('Stored Workroom control projection does not match the governed payload');
-        }
-        const { control: _control, ...eventHeader } = event;
-        return Object.freeze({
-            ...eventHeader,
-            version: 1,
-            payload: Object.freeze({ ...payload }),
-        });
-    }));
-    return Object.freeze(materialized);
-}
-async function reconcileJournalPayloads(runId, events, payloads) {
-    if (!payloads.reconcile || events.length === 0)
-        return;
-    await payloads.reconcile({
-        projectId: storedProjectId(events),
-        runId,
-        receipts: collectGovernedPayloadReceipts(events),
-        publicationDigest: journalPublicationDigest(runId, events),
-    });
-}
-function journalPublicationDigest(runId, events) {
-    return digestCanonicalWorkroomValue({
-        version: 1,
-        runId,
-        eventHeaders: events.map(event => ({
-            eventId: event.eventId,
-            sequence: event.sequence,
-            type: event.type,
-            control: event.control,
-            payload: event.payload,
-        })),
-    });
-}
-function verifyJournalPayloadPublication(intent, events) {
-    if (intent.consumer !== 'journal_header')
-        return deepFreeze({ status: 'unknown' });
-    const runId = intent.publicationScope;
-    if (!runId || events.length === 0 || events.some(event => event.runId !== runId)) {
-        return deepFreeze({ status: 'missing' });
-    }
-    const exact = collectGovernedPayloadReceipts(events).some(receipt => receipt.descriptor.objectId === intent.objectId
-        && receipt.descriptor.payloadHash === intent.payloadHash
-        && receipt.descriptor.descriptorDigest === intent.descriptorDigest
-        && receipt.source.bindingDigest === intent.sourceBindingDigest);
-    return exact
-        ? deepFreeze({
-            status: 'exact',
-            publicationDigest: journalPublicationDigest(runId, events),
-        })
-        : deepFreeze({ status: 'missing' });
-}
-function collectGovernedPayloadReceipts(events) {
-    const receipts = [];
-    const visit = (value) => {
-        if (isGovernedJournalPayloadReference(value)) {
-            receipts.push(value.receipt);
-            return;
-        }
-        if (Array.isArray(value)) {
-            for (const item of value)
-                visit(item);
-            return;
-        }
-        if (isRecord(value)) {
-            for (const item of Object.values(value))
-                visit(item);
-        }
-    };
-    for (const event of events)
-        visit(event.payload);
-    return Object.freeze(receipts);
-}
-async function materializeValue(value, fieldPath, event, projectId, payloads) {
-    if (isGovernedJournalPayloadReference(value)) {
-        if (value.fieldPath !== fieldPath)
-            throw new Error('Governed Workroom Journal payload field binding drift');
-        const source = journalPayloadSource(event, fieldPath, value.contentHash);
-        assertJournalPayloadReceipt(value.receipt, createWorkroomJournalPayloadObjectId({
-            projectId,
-            runId: event.runId,
-            eventId: event.eventId,
-            eventType: event.type,
-            occurredAt: event.occurredAt,
-            fieldPath,
-            contentHash: value.contentHash,
-        }), value.contentHash, source);
-        const materialized = await payloads.read({
-            projectId,
-            runId: event.runId,
-            eventId: event.eventId,
-            eventType: event.type,
-            fieldPath,
-            contentHash: value.contentHash,
-            receipt: value.receipt,
-            purpose: 'kernel-replay',
-        });
-        if (digestCanonicalWorkroomValue(materialized) !== value.contentHash) {
-            throw new Error('Governed Workroom Journal payload content hash mismatch');
-        }
-        if (Buffer.byteLength(canonicalWorkroomJson(materialized)) !== value.receipt.descriptor.bytes) {
-            throw new Error('Governed Workroom Journal payload byte length mismatch');
-        }
-        return materialized;
-    }
-    if (Array.isArray(value)) {
-        return Object.freeze(await Promise.all(value.map((item, index) => materializeValue(item, `${fieldPath}[${index}]`, event, projectId, payloads))));
-    }
-    if (!isRecord(value))
-        return value;
-    return Object.freeze(Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, child]) => [
-        key,
-        await materializeValue(child, `${fieldPath}.${key}`, event, projectId, payloads),
-    ]))));
-}
-function projectIdForAppend(current, appended) {
-    if (current.length > 0)
-        return storedProjectId(current);
-    const created = appended[0];
-    if (!created || created.type !== 'run.created' || !isNonEmptyString(created.payload.projectId)) {
-        throw new Error('Workroom Journal first append must begin with a Project-bound run.created event');
-    }
-    return created.payload.projectId;
-}
-function storedProjectId(events) {
-    const created = events[0];
-    if (!created || created.type !== 'run.created' || !isNonEmptyString(created.payload.projectId)) {
-        throw new Error('Stored Workroom Journal has no Project-bound run.created header');
-    }
-    return created.payload.projectId;
-}
-function journalPayloadSource(event, fieldPath, contentHash) {
-    const ref = `workroom-journal-event:${event.runId}:${event.eventId}:${fieldPath}`;
-    const sourceBody = Object.freeze({
-        version: 1,
-        runId: event.runId,
-        eventId: event.eventId,
-        eventType: event.type,
-        fieldPath,
-        contentHash,
-    });
-    const sourceDigest = digestCanonicalWorkroomValue(sourceBody);
-    return Object.freeze({
-        ref,
-        digest: sourceDigest,
-        bindingDigest: digestCanonicalWorkroomValue({ ref, sourceDigest, ...sourceBody }),
-    });
-}
-function assertJournalPayloadReceipt(receipt, objectId, contentHash, source) {
-    if (!receipt || !isRecord(receipt.descriptor) || !isRecord(receipt.source)
-        || !isNonEmptyString(receipt.descriptor.vaultObjectId)
-        || receipt.descriptor.objectId !== objectId
-        || receipt.descriptor.payloadHash !== contentHash
-        || !isDigest(receipt.descriptor.descriptorDigest)
-        || !isDigest(receipt.descriptor.locationManifestDigest)
-        || !Number.isSafeInteger(receipt.descriptor.bytes) || Number(receipt.descriptor.bytes) < 0
-        || receipt.source.kind !== 'command'
-        || receipt.source.ref !== source.ref
-        || receipt.source.digest !== source.digest
-        || receipt.source.bindingDigest !== source.bindingDigest
-        || receipt.source.verification !== 'verified') {
-        throw new Error('Governed Workroom Journal payload receipt is forged or incomplete');
-    }
-}
-function assertStoredEventReceiptBindings(events) {
-    if (events.length === 0)
-        return;
-    const projectId = storedProjectId(events);
-    const visit = (value, fieldPath, event) => {
-        if (isGovernedJournalPayloadReference(value)) {
-            if (value.fieldPath !== fieldPath) {
-                throw new Error('Governed Workroom Journal payload field binding drift');
-            }
-            const source = journalPayloadSource(event, fieldPath, value.contentHash);
-            assertJournalPayloadReceipt(value.receipt, createWorkroomJournalPayloadObjectId({
-                projectId,
-                runId: event.runId,
-                eventId: event.eventId,
-                eventType: event.type,
-                occurredAt: event.occurredAt,
-                fieldPath,
-                contentHash: value.contentHash,
-            }), value.contentHash, source);
-            return;
-        }
-        if (Array.isArray(value)) {
-            value.forEach((item, index) => visit(item, `${fieldPath}[${index}]`, event));
-            return;
-        }
-        if (isRecord(value)) {
-            for (const [key, child] of Object.entries(value)) {
-                visit(child, `${fieldPath}.${key}`, event);
-            }
-        }
-    };
-    for (const event of events)
-        visit(event.payload, '$.payload', event);
-}
-export function createWorkroomJournalPayloadObjectId(input) {
-    return `workroom-journal-payload:${digestCanonicalWorkroomValue({
-        version: 2,
-        projectId: input.projectId,
-        runId: input.runId,
-        eventId: input.eventId,
-        eventType: input.eventType,
-        occurredAt: input.occurredAt,
-        fieldPath: input.fieldPath,
-        contentHash: input.contentHash,
-    })}`;
-}
-function isGovernedJournalPayloadReference(value) {
-    if (!isRecord(value) || value.version !== 1 || value.kind !== 'governed_workroom_journal_payload'
-        || !isNonEmptyString(value.fieldPath) || !isDigest(value.contentHash)
-        || !isRecord(value.receipt))
-        return false;
-    const keys = Object.keys(value).sort();
-    return keys.length === 5
-        && ['contentHash', 'fieldPath', 'kind', 'receipt', 'version'].every((key, index) => keys[index] === key);
-}
-function validateProtectedPayload(type, payload) {
-    assertAllowedPayloadKeys(type, payload);
-    const visit = (value, fieldPath) => {
-        if (isGovernedJournalPayloadReference(value)) {
-            if (value.fieldPath !== fieldPath)
-                throw new Error('Governed Workroom Journal payload path is invalid');
-            return;
-        }
-        if (Array.isArray(value)) {
-            value.forEach((item, index) => visit(item, `${fieldPath}[${index}]`));
-            return;
-        }
-        if (!isRecord(value))
-            return;
-        for (const [key, child] of Object.entries(value)) {
-            if (!isContentFreeJournalValue(type, `${fieldPath}.${key}`, child) && containsGovernedValue(child)
-                && !isGovernedJournalPayloadReference(child)) {
-                throw legacyJournalPayloadError();
-            }
-            visit(child, `${fieldPath}.${key}`);
-        }
-    };
-    visit(payload, '$.payload');
-}
-function isContentFreeJournalValue(type, fieldPath, value) {
-    if (value === undefined || value === null || value === '')
-        return true;
-    if (typeof value === 'boolean' || (typeof value === 'number' && Number.isFinite(value)))
-        return true;
-    if (typeof value !== 'string')
-        return false;
-    if (type === 'run.created' && fieldPath === '$.payload.projectId')
-        return true;
-    return isDigest(value);
-}
-function containsGovernedValue(value) {
-    if (value === undefined || value === null || value === '')
-        return false;
-    if (Array.isArray(value))
-        return value.length > 0;
-    return typeof value !== 'object' || Object.keys(value).length > 0;
-}
-function legacyJournalPayloadError() {
-    return new LegacyEmbeddedPayloadDetectedError('Legacy embedded Workroom Journal payload is quarantined; use offline export/purge verification before activation');
-}
-function isDigest(value) {
-    return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/u.test(value);
-}
-const WORKROOM_EVENT_TYPES = new Set([
-    'run.created', 'run.control_decided', 'run.replan_requested',
-    'run.cancel_requested', 'run.cancelled', 'plan.admitted', 'plan_gate.decided',
-    'plan.revision_applied',
-    'task.planned', 'task.blocked', 'task.blocker_resolved',
-    'task.cancel_requested', 'task.cancelled', 'task.failed',
-    'task.accepted', 'task.acceptance_pinned', 'task.acceptance_blocked', 'task.rework_requested', 'task.revised',
-    'task.plan_revised',
-    'reviewer.assigned', 'reviewer.claimed', 'reviewer.verdict_recorded', 'reviewer.expired',
-    'sponsor_gate.opened', 'sponsor_gate.decided', 'sponsor_gate.expired',
-    'assignment.claimed', 'assignment.started', 'assignment.heartbeat',
-    'assignment.progress', 'assignment.checkpointed',
-    'assignment.checkpoint_requested', 'assignment.preempted',
-    'assignment.execution_completed', 'assignment.cancel_requested',
-    'assignment.cancelled', 'assignment.lease_expired',
-    'scheduler.dispatch_requested', 'scheduler.priority_changed', 'scheduler.preemption_requested',
-    'scheduler.preemption_checkpoint_acknowledged', 'scheduler.preemption_timed_out',
-    'local_execution.requested',
-    'remote_dispatch.requested', 'clock.advanced',
-]);
-function isWorkroomEventType(value) {
-    return typeof value === 'string' && WORKROOM_EVENT_TYPES.has(value);
-}
-/**
- * Closed top-level schema for every persisted Kernel fact. Values not listed
- * here are rejected before either the Journal header or Payload Vault is
- * written, so adding a future field requires an explicit governance choice.
- */
-const WORKROOM_EVENT_PAYLOAD_KEYS = Object.freeze({
-    'run.created': ['projectId', 'title'],
-    'run.control_decided': [
-        'operationId', 'action', 'reasonCode', 'expectedSequence', 'principalId', 'requestDigest',
-        'catalogRevision', 'projectDigest', 'authorizationRef',
-        'stateSequence', 'stateStatus', 'stateDigest',
-    ],
-    'run.replan_requested': ['operationId', 'reasonCode', 'requestDigest'],
-    'run.cancel_requested': ['reason'],
-    'run.cancelled': ['reason'],
-    'plan.admitted': [
-        'operationId', 'sourceEventRef', 'sourceEventDigest', 'orchestratorAgentDefinitionId',
-        'plan', 'schedulerPolicy',
-    ],
-    'plan.revision_applied': ['candidate', 'planRevision', 'recomputedDiffDigest'],
-    'plan_gate.decided': [
-        'operationId', 'requestDigest', 'taskKey', 'taskRevision', 'gateId', 'planDigest',
-        'policyRevisionId', 'policyDigest', 'decision', 'sponsorPrincipalId', 'authorizedBy',
-        'reasonDigest',
-    ],
-    'task.planned': [
-        'type', 'taskKey', 'title', 'required', 'maxAttempts', 'role', 'dependsOn', 'requires',
-        'sponsorLane', 'localRank', 'deadline', 'enqueuedAt', 'preemptibility', 'approvalGate',
-    ],
-    'task.blocked': [
-        'type', 'taskKey', 'blockerId', 'kind', 'owner', 'reason', 'deadline', 'allowedActions',
-    ],
-    'task.blocker_resolved': ['type', 'taskKey', 'blockerId'],
-    'task.cancel_requested': ['taskKey', 'reason'],
-    'task.cancelled': ['taskKey', 'reason'],
-    'task.failed': ['taskKey', 'reason'],
-    'task.accepted': ['taskKey', 'reportRef', 'record'],
-    'task.acceptance_pinned': ['taskKey', 'contract'],
-    'task.acceptance_blocked': ['taskKey', 'reportRef', 'reason', 'evaluation'],
-    'task.rework_requested': ['type', 'taskKey', 'reason', 'evaluation'],
-    'task.revised': ['type', 'taskKey', 'title', 'reason', 'maxAttempts'],
-    'task.plan_revised': [
-        'taskKey', 'title', 'required', 'maxAttempts', 'role', 'dependsOn', 'requires',
-        'sponsorLane', 'localRank', 'deadline', 'enqueuedAt', 'preemptibility', 'approvalGate',
-        'expectedTaskRevision', 'newTaskRevision', 'reason',
-    ],
-    'reviewer.assigned': ['taskKey', 'reason', 'assignment'],
-    'reviewer.claimed': [
-        'taskKey', 'assignmentId', 'reviewerPrincipalId', 'authorizedBy', 'authorization',
-    ],
-    'reviewer.verdict_recorded': [
-        'taskKey', 'assignmentId', 'reviewerPrincipalId', 'authorizedBy', 'outcome',
-        'verdict', 'authorization',
-    ],
-    'reviewer.expired': ['taskKey', 'assignmentId'],
-    'sponsor_gate.opened': ['taskKey', 'reason', 'gate'],
-    'sponsor_gate.decided': [
-        'taskKey', 'gateId', 'sponsorPrincipalId', 'authorizedBy', 'reason', 'candidateHash',
-        'decision', 'authorization',
-    ],
-    'sponsor_gate.expired': ['taskKey', 'gateId'],
-    'assignment.claimed': [
-        'type', 'taskKey', 'assignmentId', 'owner', 'role', 'taskRevision', 'attempt',
-        'assignmentRevision', 'fence', 'envelopeDigest', 'leaseExpiresAt',
-    ],
-    'assignment.started': ['assignmentId'],
-    'assignment.progress': [
-        'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest', 'progress',
-    ],
-    'assignment.heartbeat': [
-        'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest', 'leaseExpiresAt',
-    ],
-    'assignment.checkpointed': [
-        'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest',
-        'checkpointRef', 'checkpointDigest',
-    ],
-    'assignment.checkpoint_requested': [
-        'decisionId', 'assignmentId', 'envelopeDigest', 'reservedTaskKey', 'requestedAt',
-        'deadline', 'takeoverFence', 'owner', 'allowedSuccessors',
-    ],
-    'assignment.preempted': [
-        'decisionId', 'assignmentId', 'checkpointRef', 'checkpointDigest', 'outcome',
-    ],
-    'assignment.execution_completed': [
-        'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest', 'reportRef',
-        'reportDigest', 'candidateRef', 'candidateHash', 'completionReceiptDigest',
-    ],
-    'assignment.cancel_requested': ['assignmentId', 'controlDeadline'],
-    'assignment.cancelled': ['assignmentId', 'outcome'],
-    'assignment.lease_expired': ['assignmentId'],
-    'scheduler.dispatch_requested': [
-        'version', 'type', 'decisionId', 'digest', 'projectId', 'runId', 'expectedSequence',
-        'taskKey', 'taskRevision', 'role', 'sponsorLane', 'reason', 'policy',
-    ],
-    'scheduler.priority_changed': [
-        'version', 'type', 'proposalId', 'digest', 'projectId', 'runId', 'taskKey',
-        'taskRevision', 'expectedSequence', 'currentLane', 'requestedLane', 'localRank',
-        'principalId', 'authority', 'authorityRef', 'deadline', 'owner', 'allowedSuccessors',
-        'authorizedBy',
-    ],
-    'scheduler.preemption_requested': [
-        'version', 'type', 'decisionId', 'digest', 'projectId', 'runId', 'expectedSequence',
-        'victimTaskKey', 'victimTaskRevision', 'reservedTaskKey', 'reservedTaskRevision',
-        'assignmentId', 'assignmentAttempt', 'assignmentFence', 'assignmentEnvelopeDigest',
-        'owner', 'requestedAt', 'deadline', 'takeoverFence', 'reason', 'allowedSuccessors', 'policy',
-    ],
-    'scheduler.preemption_checkpoint_acknowledged': [
-        'decisionId', 'assignmentId', 'envelopeDigest', 'observationId', 'observationDigest',
-        'checkpointRef', 'checkpointDigest', 'assignmentAttempt', 'assignmentFence', 'takeoverFence',
-    ],
-    'scheduler.preemption_timed_out': [
-        'decisionId', 'assignmentId', 'reservedTaskKey', 'blockerId', 'owner', 'deadline',
-        'allowedSuccessors', 'reason',
-    ],
-    'local_execution.requested': [
-        'operationId', 'requestDigest', 'agentDefinitionId', 'issuedAt', 'envelope',
-    ],
-    'remote_dispatch.requested': [
-        'operationId', 'requestDigest', 'issuedAt', 'reconcileDeadline', 'envelope', 'dispatchItem',
-    ],
-    'clock.advanced': ['now'],
-});
-function assertAllowedPayloadKeys(type, payload) {
-    const allowed = WORKROOM_EVENT_PAYLOAD_KEYS[type];
-    if (Object.keys(payload).some(key => !allowed.includes(key))) {
-        throw new Error(`Invalid Workroom event payload keys: ${type}`);
-    }
-}
-function validatePayload(type, payload, sequence) {
-    assertAllowedPayloadKeys(type, payload);
-    switch (type) {
-        case 'run.created':
-            requirePayloadString(payload, 'projectId');
-            requirePayloadString(payload, 'title');
-            return;
-        case 'run.control_decided':
-            requirePayloadString(payload, 'operationId');
-            requirePayloadEnum(payload, 'action', ['cancel', 'request_replan']);
-            requirePayloadString(payload, 'reasonCode');
-            if (payload.action === 'cancel'
-                ? !isWorkroomRunCancelReasonCode(payload.reasonCode)
-                : !isWorkroomRunReplanReasonCode(payload.reasonCode)) {
-                throw new Error('Invalid Workroom event payload: Run control reasonCode');
-            }
-            if (!Number.isSafeInteger(payload.expectedSequence) || Number(payload.expectedSequence) < 0) {
-                throw new Error('Invalid Workroom event payload: expectedSequence');
-            }
-            requirePayloadString(payload, 'principalId');
-            requirePayloadDigest(payload, 'requestDigest');
-            requirePayloadString(payload, 'catalogRevision');
-            requirePayloadDigest(payload, 'projectDigest');
-            requirePayloadString(payload, 'authorizationRef');
-            if (!Number.isSafeInteger(payload.stateSequence) || Number(payload.stateSequence) < 0) {
-                throw new Error('Invalid Workroom event payload: stateSequence');
-            }
-            requirePayloadEnum(payload, 'stateStatus', [
-                'active', 'blocked', 'needs_replan', 'cancelling', 'completed', 'cancelled',
-            ]);
-            requirePayloadDigest(payload, 'stateDigest');
-            return;
-        case 'run.replan_requested':
-            requirePayloadString(payload, 'operationId');
-            requirePayloadString(payload, 'reasonCode');
-            if (!isWorkroomRunReplanReasonCode(payload.reasonCode)) {
-                throw new Error('Invalid Workroom event payload: replan reasonCode');
-            }
-            requirePayloadDigest(payload, 'requestDigest');
-            return;
-        case 'plan.admitted':
-            requirePayloadString(payload, 'operationId');
-            requirePayloadString(payload, 'sourceEventRef');
-            requirePayloadDigest(payload, 'sourceEventDigest');
-            requirePayloadString(payload, 'orchestratorAgentDefinitionId');
-            assertWorkflowPlanProposal(requirePayloadRecord(payload, 'plan'));
-            if (payload.schedulerPolicy !== undefined) {
-                assertWorkroomSchedulerPolicySnapshot(payload.schedulerPolicy, sequence);
-            }
-            return;
-        case 'plan.revision_applied': {
-            const candidate = requirePayloadRecord(payload, 'candidate');
-            assertWorkflowPlanRevisionCandidate(candidate);
-            requirePayloadPositiveInteger(payload, 'planRevision');
-            requirePayloadDigest(payload, 'recomputedDiffDigest');
-            if (payload.recomputedDiffDigest !== digestCanonicalWorkroomValue(candidate.diff)) {
-                throw new Error('Persisted Plan Revision recomputed diff digest is invalid');
-            }
-            return;
-        }
-        case 'plan_gate.decided':
-            requirePayloadString(payload, 'operationId');
-            requirePayloadDigest(payload, 'requestDigest');
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadPositiveInteger(payload, 'taskRevision');
-            requirePayloadString(payload, 'gateId');
-            requirePayloadDigest(payload, 'planDigest');
-            requirePayloadString(payload, 'policyRevisionId');
-            requirePayloadDigest(payload, 'policyDigest');
-            requirePayloadEnum(payload, 'decision', ['approve', 'reject', 'request_changes', 'cancel']);
-            requirePayloadString(payload, 'sponsorPrincipalId');
-            requirePayloadString(payload, 'authorizedBy');
-            requirePayloadDigest(payload, 'reasonDigest');
-            return;
-        case 'local_execution.requested':
-            parseWorkroomLocalAssignmentIssuance(payload);
-            return;
-        case 'remote_dispatch.requested':
-            parseWorkroomRemoteAssignmentIssuance(payload);
-            return;
-        case 'scheduler.dispatch_requested':
-            parseWorkroomDispatchTaskDecision(payload);
-            return;
-        case 'scheduler.priority_changed':
-            requirePayloadString(payload, 'proposalId');
-            requirePayloadDigest(payload, 'digest');
-            requirePayloadString(payload, 'projectId');
-            requirePayloadString(payload, 'runId');
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadPositiveInteger(payload, 'taskRevision');
-            requirePayloadEnum(payload, 'currentLane', ['urgent', 'high', 'normal', 'low']);
-            requirePayloadEnum(payload, 'requestedLane', ['urgent', 'high', 'normal', 'low']);
-            requirePayloadEnum(payload, 'authority', ['sponsor', 'orchestrator']);
-            requirePayloadString(payload, 'principalId');
-            requirePayloadString(payload, 'authorityRef');
-            requirePayloadString(payload, 'owner');
-            requirePayloadNumber(payload, 'deadline');
-            requirePayloadString(payload, 'authorizedBy');
-            parseWorkroomPriorityChangeProposal({
-                version: payload.version,
-                type: payload.type,
-                proposalId: payload.proposalId,
-                digest: payload.digest,
-                projectId: payload.projectId,
-                runId: payload.runId,
-                taskKey: payload.taskKey,
-                taskRevision: payload.taskRevision,
-                expectedSequence: payload.expectedSequence,
-                currentLane: payload.currentLane,
-                requestedLane: payload.requestedLane,
-                localRank: payload.localRank,
-                principalId: payload.principalId,
-                authority: payload.authority,
-                authorityRef: payload.authorityRef,
-                deadline: payload.deadline,
-                owner: payload.owner,
-                allowedSuccessors: payload.allowedSuccessors,
-            });
-            if (payload.authorizedBy !== payload.authorityRef) {
-                throw new Error('Persisted Workroom priority authority proof is not exact');
-            }
-            return;
-        case 'scheduler.preemption_requested':
-            parseWorkroomPreemptionPrepareDecision(payload);
-            return;
-        case 'scheduler.preemption_checkpoint_acknowledged':
-            requirePayloadString(payload, 'decisionId');
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadDigest(payload, 'envelopeDigest');
-            requirePayloadString(payload, 'observationId');
-            requirePayloadDigest(payload, 'observationDigest');
-            requirePayloadString(payload, 'checkpointRef');
-            requirePayloadDigest(payload, 'checkpointDigest');
-            requirePayloadPositiveInteger(payload, 'assignmentAttempt');
-            requirePayloadPositiveInteger(payload, 'assignmentFence');
-            requirePayloadPositiveInteger(payload, 'takeoverFence');
-            if (payload.takeoverFence !== Number(payload.assignmentFence) + 1) {
-                throw new Error('Invalid Workroom event payload: preemption takeover fence');
-            }
-            return;
-        case 'scheduler.preemption_timed_out':
-            requirePayloadString(payload, 'decisionId');
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadString(payload, 'reservedTaskKey');
-            requirePayloadString(payload, 'blockerId');
-            requirePayloadString(payload, 'owner');
-            requirePayloadNumber(payload, 'deadline');
-            requirePayloadString(payload, 'reason');
-            if (canonicalWorkroomJson(payload.allowedSuccessors) !== canonicalWorkroomJson(['replan', 'cancel_run'])) {
-                throw new Error('Invalid Workroom event payload: preemption timeout successors');
-            }
-            return;
-        case 'run.cancel_requested':
-        case 'run.cancelled':
-            requirePayloadString(payload, 'reason');
-            return;
-        case 'task.planned':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'title');
-            requirePayloadBoolean(payload, 'required');
-            requirePayloadPositiveInteger(payload, 'maxAttempts');
-            if (payload.approvalGate !== undefined) {
-                const gate = requirePayloadRecord(payload, 'approvalGate');
-                requirePayloadString(gate, 'id');
-                requirePayloadEnum(gate, 'kind', ['sponsor']);
-                requirePayloadString(gate, 'owner');
-                requirePayloadPositiveInteger(gate, 'decisionTimeoutMs');
-                requirePayloadString(gate, 'policyRevisionId');
-                requirePayloadDigest(gate, 'policyDigest');
-                if (!Array.isArray(gate.allowedActions)
-                    || canonicalWorkroomJson(gate.allowedActions) !== canonicalWorkroomJson(['approve', 'reject', 'replan', 'cancel'])) {
-                    throw new Error('Invalid Workroom event payload: approvalGate allowedActions');
-                }
-            }
-            return;
-        case 'task.blocked':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'blockerId');
-            requirePayloadEnum(payload, 'kind', ['dependency', 'approval', 'capability', 'external', 'human_input']);
-            requirePayloadString(payload, 'owner');
-            requirePayloadString(payload, 'reason');
-            requirePayloadNumber(payload, 'deadline');
-            return;
-        case 'task.blocker_resolved':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'blockerId');
-            return;
-        case 'task.cancel_requested':
-        case 'task.cancelled':
-        case 'task.failed':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'reason');
-            return;
-        case 'task.accepted':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'reportRef');
-            assertPersistedAcceptanceRecord(payload.record, String(payload.taskKey), String(payload.reportRef), sequence);
-            return;
-        case 'task.acceptance_pinned': {
-            requirePayloadString(payload, 'taskKey');
-            const contract = requirePayloadRecord(payload, 'contract');
-            assertAcceptanceContract(contract, String(payload.taskKey), Number(contract.taskRevision));
-            return;
-        }
-        case 'task.acceptance_blocked':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'reportRef');
-            requirePayloadString(payload, 'reason');
-            requirePayloadRecord(payload, 'evaluation');
-            return;
-        case 'reviewer.assigned':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'reason');
-            validateAcceptanceWait(requirePayloadRecord(payload, 'assignment'), String(payload.taskKey), true);
-            return;
-        case 'reviewer.expired':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'assignmentId');
-            return;
-        case 'reviewer.claimed':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadString(payload, 'reviewerPrincipalId');
-            requirePayloadString(payload, 'authorizedBy');
-            requirePayloadRecord(payload, 'authorization');
-            return;
-        case 'reviewer.verdict_recorded':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadEnum(payload, 'outcome', ['passed', 'rework']);
-            requirePayloadRecord(payload, 'verdict');
-            requirePayloadRecord(payload, 'authorization');
-            return;
-        case 'sponsor_gate.opened':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'reason');
-            validateAcceptanceWait(requirePayloadRecord(payload, 'gate'), String(payload.taskKey), false);
-            return;
-        case 'sponsor_gate.expired':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'gateId');
-            return;
-        case 'sponsor_gate.decided':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'gateId');
-            requirePayloadString(payload, 'sponsorPrincipalId');
-            requirePayloadString(payload, 'authorizedBy');
-            requirePayloadString(payload, 'reason');
-            requirePayloadString(payload, 'candidateHash');
-            requirePayloadEnum(payload, 'decision', ['approve', 'reject', 'request_changes', 'cancel']);
-            requirePayloadRecord(payload, 'authorization');
-            return;
-        case 'task.rework_requested':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'reason');
-            return;
-        case 'task.revised':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'title');
-            requirePayloadString(payload, 'reason');
-            requirePayloadPositiveInteger(payload, 'maxAttempts');
-            return;
-        case 'task.plan_revised':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadPositiveInteger(payload, 'expectedTaskRevision');
-            requirePayloadPositiveInteger(payload, 'newTaskRevision');
-            requirePayloadString(payload, 'title');
-            requirePayloadBoolean(payload, 'required');
-            requirePayloadPositiveInteger(payload, 'maxAttempts');
-            requirePayloadString(payload, 'role');
-            requirePayloadString(payload, 'reason');
-            return;
-        case 'assignment.claimed':
-            requirePayloadString(payload, 'taskKey');
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadString(payload, 'owner');
-            requirePayloadEnum(payload, 'role', ['executor', 'reviewer', 'integration']);
-            requirePayloadPositiveInteger(payload, 'taskRevision');
-            requirePayloadPositiveInteger(payload, 'attempt');
-            requirePayloadPositiveInteger(payload, 'assignmentRevision');
-            requirePayloadPositiveInteger(payload, 'fence');
-            requirePayloadDigest(payload, 'envelopeDigest');
-            requirePayloadNumber(payload, 'leaseExpiresAt');
-            return;
-        case 'assignment.started':
-        case 'assignment.lease_expired':
-            requirePayloadString(payload, 'assignmentId');
-            return;
-        case 'assignment.progress':
-            validateAssignmentObservationHeader(payload);
-            assertExactPayloadKeys(payload, [
-                'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest', 'progress',
-            ], type);
-            validateProgress(requirePayloadRecord(payload, 'progress'));
-            assertPersistedAssignmentObservationDigest(payload, {
-                version: 1,
-                type: 'progress',
-                observationId: payload.observationId,
-                envelopeDigest: payload.envelopeDigest,
-                progress: payload.progress,
-            });
-            return;
-        case 'assignment.heartbeat':
-            validateAssignmentObservationHeader(payload);
-            assertExactPayloadKeys(payload, [
-                'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest', 'leaseExpiresAt',
-            ], type);
-            requirePayloadNumber(payload, 'leaseExpiresAt');
-            assertPersistedAssignmentObservationDigest(payload, {
-                version: 1,
-                type: 'heartbeat',
-                observationId: payload.observationId,
-                envelopeDigest: payload.envelopeDigest,
-            });
-            return;
-        case 'assignment.checkpointed':
-            validateAssignmentObservationHeader(payload);
-            assertExactPayloadKeys(payload, [
-                'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest',
-                'checkpointRef', 'checkpointDigest',
-            ], type);
-            requirePayloadString(payload, 'checkpointRef');
-            requirePayloadDigest(payload, 'checkpointDigest');
-            assertPersistedAssignmentObservationDigest(payload, {
-                version: 1,
-                type: 'checkpoint',
-                observationId: payload.observationId,
-                envelopeDigest: payload.envelopeDigest,
-                checkpoint: { ref: payload.checkpointRef, digest: payload.checkpointDigest },
-            });
-            return;
-        case 'assignment.checkpoint_requested':
-            requirePayloadString(payload, 'decisionId');
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadDigest(payload, 'envelopeDigest');
-            requirePayloadString(payload, 'reservedTaskKey');
-            requirePayloadNumber(payload, 'requestedAt');
-            requirePayloadNumber(payload, 'deadline');
-            requirePayloadPositiveInteger(payload, 'takeoverFence');
-            requirePayloadString(payload, 'owner');
-            if (Number(payload.deadline) <= Number(payload.requestedAt)
-                || canonicalWorkroomJson(payload.allowedSuccessors) !== canonicalWorkroomJson(['replan', 'cancel_run'])) {
-                throw new Error('Invalid Workroom event payload: checkpoint request recovery metadata');
-            }
-            return;
-        case 'assignment.preempted':
-            requirePayloadString(payload, 'decisionId');
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadString(payload, 'checkpointRef');
-            requirePayloadDigest(payload, 'checkpointDigest');
-            requirePayloadEnum(payload, 'outcome', ['interrupted']);
-            return;
-        case 'assignment.execution_completed':
-            validateAssignmentObservationHeader(payload);
-            assertExactPayloadKeys(payload, [
-                'assignmentId', 'observationId', 'observationDigest', 'envelopeDigest',
-                'reportRef', 'reportDigest', 'candidateRef', 'candidateHash',
-                ...(payload.completionReceiptDigest === undefined
-                    ? []
-                    : ['completionReceiptDigest']),
-            ], type);
-            requirePayloadString(payload, 'reportRef');
-            requirePayloadDigest(payload, 'reportDigest');
-            requirePayloadString(payload, 'candidateRef');
-            requirePayloadDigest(payload, 'candidateHash');
-            if (payload.completionReceiptDigest !== undefined) {
-                requirePayloadDigest(payload, 'completionReceiptDigest');
-            }
-            assertPersistedAssignmentObservationDigest(payload, {
-                version: 1,
-                type: 'execution_completed',
-                observationId: payload.observationId,
-                envelopeDigest: payload.envelopeDigest,
-                completion: {
-                    report: { ref: payload.reportRef, digest: payload.reportDigest },
-                    candidate: { ref: payload.candidateRef, hash: payload.candidateHash },
-                    ...(payload.completionReceiptDigest === undefined
-                        ? {}
-                        : { completionReceiptDigest: payload.completionReceiptDigest }),
-                },
-            });
-            return;
-        case 'assignment.cancel_requested':
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadNumber(payload, 'controlDeadline');
-            return;
-        case 'assignment.cancelled':
-            requirePayloadString(payload, 'assignmentId');
-            requirePayloadEnum(payload, 'outcome', ['interrupted', 'committed', 'outcome_unknown']);
-            return;
-        case 'clock.advanced':
-            requirePayloadNumber(payload, 'now');
-            return;
-    }
-}
-function validateAssignmentObservationHeader(payload) {
-    requirePayloadString(payload, 'assignmentId');
-    requirePayloadString(payload, 'observationId');
-    requirePayloadDigest(payload, 'observationDigest');
-    requirePayloadDigest(payload, 'envelopeDigest');
-}
-function assertPersistedAssignmentObservationDigest(payload, observation) {
-    if (digestCanonicalWorkroomValue(observation) !== payload.observationDigest) {
-        throw new Error('Invalid Workroom event payload: observationDigest does not match body');
-    }
-}
-function validateProgress(progress) {
-    const keys = Object.keys(progress);
-    if (keys.some(key => !['summary', 'completedUnits', 'totalUnits'].includes(key))) {
-        throw new Error('Invalid Workroom event payload: progress keys');
-    }
-    requirePayloadString(progress, 'summary');
-    const completed = progress.completedUnits;
-    const total = progress.totalUnits;
-    if (completed !== undefined && (!Number.isSafeInteger(completed) || completed < 0)) {
-        throw new Error('Invalid Workroom event payload: completedUnits');
-    }
-    if (total !== undefined && (!Number.isSafeInteger(total) || total < 1)) {
-        throw new Error('Invalid Workroom event payload: totalUnits');
-    }
-    if (typeof completed === 'number' && typeof total === 'number' && completed > total) {
-        throw new Error('Invalid Workroom event payload: completedUnits exceeds totalUnits');
-    }
-}
-function assertExactPayloadKeys(payload, expected, type) {
-    const actual = Object.keys(payload).sort();
-    const canonical = [...expected].sort();
-    if (actual.length !== canonical.length || actual.some((key, index) => key !== canonical[index])) {
-        throw new Error(`Invalid Workroom event payload keys: ${type}`);
-    }
-}
-function assertExactRecordKeys(value, expected, label) {
-    const actual = Object.keys(value).sort();
-    const canonical = [...expected].sort();
-    if (actual.length !== canonical.length || actual.some((key, index) => key !== canonical[index])) {
-        throw new Error(`${label} keys are invalid`);
-    }
-}
-function validateAcceptanceWait(value, taskKey, reviewer) {
-    for (const key of ['id', 'taskKey', 'candidateHash', 'contractId', 'owner']) {
-        requirePayloadString(value, key);
-    }
-    requirePayloadPositiveInteger(value, 'taskRevision');
-    requirePayloadEnum(value, 'riskTier', ['low', 'medium', 'high', 'critical']);
-    requirePayloadEnum(value, 'route', ['reviewer_required', 'sponsor_required', 'reviewer_then_sponsor']);
-    if (value.taskKey !== taskKey)
-        throw new Error('Invalid Workroom event payload: wait taskKey');
-    requirePayloadNumber(value, 'deadline');
-    requirePayloadEnum(value, 'status', ['open']);
-    requirePayloadRecord(value, 'evaluation');
-    const policy = requirePayloadRecord(value, 'policy');
-    requirePayloadString(policy, 'id');
-    requirePayloadString(policy, 'digest');
-    requirePayloadPositiveInteger(policy, 'revision');
-    if (reviewer)
-        requirePayloadString(value, 'producerPrincipalId');
-    if (!Array.isArray(value.allowedActions) || value.allowedActions.length === 0
-        || value.allowedActions.some(action => !isNonEmptyString(action)
-            || !ACCEPTANCE_WAIT_ACTIONS.has(action))) {
-        throw new Error('Invalid Workroom event payload: allowedActions');
-    }
-}
-const ACCEPTANCE_WAIT_ACTIONS = new Set([
-    'claim', 'submit_verdict', 'approve', 'reject', 'request_changes',
-    'reassign', 'reopen', 'rebase', 'replan', 'cancel',
-]);
-function isRecord(value) {
-    return !!value && typeof value === 'object' && !Array.isArray(value);
-}
-function isNonEmptyString(value) {
-    return typeof value === 'string' && value.trim().length > 0;
-}
-function isFiniteNumber(value) {
-    return typeof value === 'number' && Number.isFinite(value);
-}
-function isSequence(value) {
-    return Number.isSafeInteger(value) && value >= 0;
-}
-function requirePayloadString(payload, key) {
-    if (!isNonEmptyString(payload[key]))
-        throw new Error(`Invalid Workroom event payload: ${key}`);
-}
-function requirePayloadNumber(payload, key) {
-    if (!isFiniteNumber(payload[key]))
-        throw new Error(`Invalid Workroom event payload: ${key}`);
-}
-function requirePayloadDigest(payload, key) {
-    if (typeof payload[key] !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(payload[key])) {
-        throw new Error(`Invalid Workroom event payload: ${key}`);
-    }
-}
-function requirePayloadRecord(payload, key) {
-    if (!isRecord(payload[key]))
-        throw new Error(`Invalid Workroom event payload: ${key}`);
-    return payload[key];
-}
-function requirePayloadPositiveInteger(payload, key) {
-    const value = payload[key];
-    if (!Number.isSafeInteger(value) || value < 1) {
-        throw new Error(`Invalid Workroom event payload: ${key}`);
-    }
-}
-function requirePayloadBoolean(payload, key) {
-    if (typeof payload[key] !== 'boolean')
-        throw new Error(`Invalid Workroom event payload: ${key}`);
-}
-function requirePayloadEnum(payload, key, values) {
-    if (typeof payload[key] !== 'string' || !values.includes(payload[key])) {
-        throw new Error(`Invalid Workroom event payload: ${key}`);
-    }
-}
-//# sourceMappingURL=journal.js.map